From fe3306bf900668034fd9cf9604407c5abe535d0f Mon Sep 17 00:00:00 2001 From: kosaki Date: Wed, 14 Sep 2011 02:46:37 +0000 Subject: merge revision(s) 33266: * thread.c (rb_fd_rcopy): added an argument guard. Patch by NAKAMURA Usaku. [Bug #5306] [ruby-core:39435] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@33268 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- thread.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'thread.c') diff --git a/thread.c b/thread.c index a6d709aaed..d9fe5506bc 100644 --- a/thread.c +++ b/thread.c @@ -2465,7 +2465,9 @@ rb_fd_rcopy(fd_set *dst, rb_fdset_t *src) { int max = rb_fd_max(src); - if (max > FD_SETSIZE) { + /* we assume src is the result of select() with dst, so dst should be + * larger or equal than src. */ + if (max > FD_SETSIZE || max > dst->fd_count) { rb_raise(rb_eArgError, "too large fdsets"); } -- cgit v1.2.3